CVE-2020-37286

Deferred Deferred - Pending Action

Memory Corruption in Vyper Smart Contract Language

Publication date: 2026-10-21

Last updated on: 2026-10-27

Assigner: VulnCheck

Description

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested calls. Contracts using such calls as tuple elements, call arguments, or builtin arguments like concat or ecrecover can return corrupted values or pass wrong arguments to external calls.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-27

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2020-37286

EUVD

EUVD-2020-31282

Affected Vendors & Products

Vendor	Product	Version / Range
vyperlang	vyper	0.1.0b4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

CVE-2020-37286 is a memory corruption vulnerability in the Vyper programming language. It occurs when internal function calls are nested within tuples or other nested function calls. This causes an incorrect stack tip pointer, leading to corrupted memory handling. The issue affects Vyper versions from 0.1.0b4 up to but not including 0.3.0.

Detection Guidance

Detecting this vulnerability requires checking the Vyper version in use. If your system uses Vyper versions from 0.1.0b4 up to but not including 0.3.0, it is vulnerable. Run 'vyper --version' to check the installed version. If the version is within the affected range, update Vyper to version 0.3.0 or later to mitigate the issue.

Impact Analysis

This vulnerability can cause smart contracts to return corrupted values or pass incorrect arguments to external calls. This may lead to crashes, unexpected behavior, or security breaches in applications relying on Vyper. The impact includes potential financial losses or data integrity issues in smart contracts.

Compliance Impact

This vulnerability primarily affects smart contracts written in Vyper by causing memory corruption in function calls within tuples or nested calls. It does not directly impact compliance with GDPR or HIPAA, as those standards focus on data protection and privacy rather than smart contract vulnerabilities. However, if a vulnerable smart contract processes or stores personal or health data, the resulting incorrect behavior could lead to data breaches or unauthorized access, indirectly violating GDPR or HIPAA requirements.

Mitigation Strategies

Upgrade Vyper to version 0.3.0 or later to address the memory corruption issue caused by incorrect stack tip pointers in nested function calls.

Hi! I’m here to help you understand CVE-2020-37286. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...